Some resolvers won't switch to TCP if the host in the DNS isn't answering UDP. My work proxy doesn't do that, for starters.

I've got some knob sending spoofed UDP "NS? ." queries (part of a DDoS attack on someone else, as far as I can tell) and although I'm throwing them away at the first point of filtering, he won't stop sending the,. So I wondered if he'd give up if I turned off DNS UDP forwarding. If my domain name appears to have "gone away" today, that's why.

Wade.

Though I don't recall the RFC saying attempting DNS via UDP first is mandatory or recommended and couldn't be bothered to go look. :-) But I admit to being curious as to how accomodating resolvers might be on that point, which is why I changed it.

Wade.